Keycloak/SSO together with a Matrix - mxisd or matrix-synapse-rest-auth REST authentication password provider module?

[vilyaua]

@spantaleev What would you suggest as a final solution to use Keycloak/SSO together with a Matrix ?

We see several auth options on the link
https://github.com/spantaleev/matrix-docker-ansible-deploy

• (optional, default) an mxisd Matrix Identity server
• (optional, advanced) the matrix-synapse-rest-auth REST authentication password provider module

Another words do we to deploy mxisd or we need matrix-synapse-rest-auth ?

Originally posted by @eorlovsky in #93 (comment)

[spantaleev]

I'm not familiar with Keyclock, but looking at its website, it supports OpenId Connect and SAML.

It doesn't sound like a good fit for the REST Auth plugin.

Maybe you can use Synapse's integrated SAML SSO support?
I'm not sure how well that works, but I've seen something about it in the Synapse config, so maybe it is supported.

The playbook does not support generating a Synapse config with SAML stuff in it (yet), but you can manually edit the /matrix/synapse/config/homeserver.yaml file and restart Synapse (systemctl restart matrix-synapse) and see if you can make it work.

If it's a good fit and it works, it should be easy to add SAML configuration support to this playbook.

[vilyaua]

Thank you, we'll try moving that direction.

[vilyaua]

Good afternoon. @spantaleev!

The access to the installation directory is restricted for the root. Which way is preferable to manually edit configs as you proposed earlier?

Didn't find the password for the matrix user, just UID and GID (991)
Sorry, I'm a newbie as for the Ansible Playbook

[spantaleev]

You can edit configuration as root.

For such questions, it may be easier to just come to the support room: https://github.com/spantaleev/matrix-docker-ansible-deploy#support

[spantaleev]

I guess we can close this now.

The solution was to use mxisd and a new project available here: https://github.com/perfsys/matrix-mxisd-aws-keycloak-endpoints

[hungrymonkey]

matrix-org/synapse#7256

Openid will added around matrix synapse 1.14 release

[hungrymonkey]

Keycloak docs added
matrix-org/synapse@5c5516f